Web & TLS security posture auditor — a read-only companion to
netscan. Where netscan finds the
open port, webscan audits the web service behind it: security headers, TLS
configuration, cookie flags and information disclosure. It scores the target
0–100 and produces a self-contained, bilingual (EN/ES) HTML report.
Inspired by SSL Labs, Mozilla Observatory and securityheaders.com. It performs no exploitation — only ordinary GET requests and TLS handshakes used to enumerate supported protocol versions.
Auditor de postura de seguridad web y TLS, de solo lectura. Analiza cabeceras de seguridad, configuracion TLS, flags de cookies y divulgacion de informacion, puntua el objetivo de 0 a 100 y genera un informe HTML autocontenido y bilingue (EN/ES). Sin explotacion: solo peticiones GET y handshakes TLS.
The HTML report is self-contained: a score gauge, a severity summary and a recommendation per finding — with a one-click EN/ES toggle for the whole page.
El informe HTML es autocontenido: un medidor de puntuacion, un resumen por severidad y una recomendacion por hallazgo, con un toggle EN/ES para toda la pagina.
| ID | Severity | Check |
|---|---|---|
| TLS-00 | 🟠 HIGH | Site served over plain HTTP (no TLS) |
| TLS-01/02 | 🔴 CRITICAL | Invalid or expired certificate |
| TLS-03/04 | 🟠/🟡 | Certificate expiring soon |
| TLS-05 | 🔴 CRITICAL | SSLv3 enabled (POODLE) |
| TLS-06/07 | 🟠/🟡 | TLS 1.0 / 1.1 enabled (deprecated) |
| TLS-08/09 | 🟡/🔵 | TLS 1.2 / 1.3 not supported |
| RED-01 | 🟡 MEDIUM | HTTP not redirected to HTTPS |
| HDR-01→03 | 🟠/🔵 | Missing / weak HSTS |
| HDR-04 | 🟡 MEDIUM | Missing Content-Security-Policy |
| HDR-05 | 🟡 MEDIUM | No clickjacking protection (X-Frame-Options / frame-ancestors) |
| HDR-06→08 | 🔵 | Missing X-Content-Type-Options / Referrer-Policy / Permissions-Policy |
| CKI-01→03 | 🟠/🟡/🔵 | Cookies without Secure / HttpOnly / SameSite |
| INF-01/02 | 🔵 LOW | Server version and technology disclosure |
Severity weights feed the score: CRITICAL −40, HIGH −20, MEDIUM −10, LOW −4, INFO 0 (floored at 0).
git clone https://github.com/mr7security/webscan.git
cd webscan
pip install -r requirements.txt
# optional, for the `webscan` command:
pip install -e .Requires Python 3.9+. The only dependency is requests; TLS inspection uses
the standard library.
# Basic audit -> writes report.html
python -m webscan example.com
# Choose the console language (the HTML report is always bilingual)
python -m webscan https://example.com --lang es
# Custom report path and JSON output
python -m webscan example.com -o example.report.html --json results.json
# Print JSON to stdout, skip the HTML report
python -m webscan example.com --no-report --json
# Installed as a command
webscan example.com| Flag | Description |
|---|---|
target |
URL or domain (bare domains default to HTTPS) |
-o, --output |
HTML report path (default report.html) |
--no-report |
Do not write the HTML report |
--json [PATH] |
Write JSON to PATH, or stdout if PATH is omitted |
--lang {en,es} |
Console language (default en) |
--timeout |
Network timeout in seconds (default 10) |
Exit codes: 0 clean or only low/medium findings, 2 at least one HIGH or
CRITICAL finding, 1 target unreachable. Handy for CI gates.
- A console summary: score, negotiated TLS version, certificate state and findings by severity.
- A self-contained HTML report (
report.html) with a score gauge, severity pills, per-finding recommendation and an EN/ES toggle — no external assets, works offline, prints cleanly to PDF. - Optional JSON for pipelines and SIEM ingestion.
webscan/
├── webscan/
│ ├── cli.py # argument parsing + orchestration
│ ├── collector.py # HTTP fetch, redirect chain, TLS handshake & cert
│ ├── checks.py # all rules (pure, unit-tested)
│ ├── models.py # Finding, Severity, bilingual text helper
│ ├── scoring.py # 0-100 posture score
│ ├── report_html.py # self-contained bilingual HTML report
│ └── report_console.py # plain-text console report
└── tests/ # offline tests for the check rules
This tool is for authorized security assessments only. Only scan systems you own or have explicit written permission to test. You are solely responsible for how you use it.
Herramienta para auditorias de seguridad autorizadas unicamente. Analiza solo sistemas propios o con permiso escrito explicito. Eres el unico responsable del uso que hagas de ella.
MIT — see LICENSE.